suricata
flow-private.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __FLOW_PRIVATE_H__
25 #define __FLOW_PRIVATE_H__
26 
27 #include "flow-hash.h"
28 #include "flow-queue.h"
29 
30 #include "util-atomic.h"
31 
32 /* global flow flags */
33 
34 /** Flow engine is in emergency mode. This means it doesn't have enough spare
35  * flows for new flows and/or it's memcap limit it reached. In this state the
36  * flow engine with evaluate flows with lower timeout settings. */
37 #define FLOW_EMERGENCY 0x01
38 
39 /* Flow Time out values */
40 #define FLOW_DEFAULT_NEW_TIMEOUT 30
41 #define FLOW_DEFAULT_EST_TIMEOUT 300
42 #define FLOW_DEFAULT_CLOSED_TIMEOUT 0
43 #define FLOW_DEFAULT_BYPASSED_TIMEOUT 100
44 #define FLOW_IPPROTO_TCP_NEW_TIMEOUT 30
45 #define FLOW_IPPROTO_TCP_EST_TIMEOUT 300
46 #define FLOW_IPPROTO_TCP_BYPASSED_TIMEOUT 100
47 #define FLOW_IPPROTO_UDP_NEW_TIMEOUT 30
48 #define FLOW_IPPROTO_UDP_EST_TIMEOUT 300
49 #define FLOW_IPPROTO_UDP_BYPASSED_TIMEOUT 100
50 #define FLOW_IPPROTO_ICMP_NEW_TIMEOUT 30
51 #define FLOW_IPPROTO_ICMP_EST_TIMEOUT 300
52 #define FLOW_IPPROTO_ICMP_BYPASSED_TIMEOUT 100
53 
54 #define FLOW_DEFAULT_EMERG_NEW_TIMEOUT 10
55 #define FLOW_DEFAULT_EMERG_EST_TIMEOUT 100
56 #define FLOW_DEFAULT_EMERG_CLOSED_TIMEOUT 0
57 #define FLOW_DEFAULT_EMERG_BYPASSED_TIMEOUT 50
58 #define FLOW_IPPROTO_TCP_EMERG_NEW_TIMEOUT 10
59 #define FLOW_IPPROTO_TCP_EMERG_EST_TIMEOUT 100
60 #define FLOW_IPPROTO_UDP_EMERG_NEW_TIMEOUT 10
61 #define FLOW_IPPROTO_UDP_EMERG_EST_TIMEOUT 100
62 #define FLOW_IPPROTO_ICMP_EMERG_NEW_TIMEOUT 10
63 #define FLOW_IPPROTO_ICMP_EMERG_EST_TIMEOUT 100
64 
65 #define FLOW_BYPASSED_TIMEOUT 6
66 
67 enum {
73 
74  /* should be last */
76 };
77 /* max used in app-layer (counters) */
78 #define FLOW_PROTO_APPLAYER_MAX FLOW_PROTO_UDP + 1
79 
80 /*
81  * Variables
82  */
83 
84 /** FlowProto specific timeouts and free/state functions */
85 
89 
90 /** spare/unused/prealloced flows live here */
92 
93 /** queue to pass flows to cleanup/log thread(s) */
95 
96 FlowBucket *flow_hash;
98 
99 /** flow memuse counter (atomic), for enforcing memcap limit */
100 SC_ATOMIC_DECLARE(uint64_t, flow_memuse);
101 
102 #endif /* __FLOW_PRIVATE_H__ */
103 
FlowQueue flow_recycle_q
Definition: flow-private.h:94
FlowProtoFreeFunc flow_freefuncs[FLOW_PROTO_MAX]
Definition: flow-private.h:88
FlowProtoTimeout flow_timeouts_normal[FLOW_PROTO_MAX]
Definition: flow-private.h:86
FlowProtoTimeout flow_timeouts_emerg[FLOW_PROTO_MAX]
Definition: flow-private.h:87
FlowConfig flow_config
Definition: flow-private.h:97
FlowBucket * flow_hash
Definition: flow-private.h:96
SC_ATOMIC_DECLARE(uint64_t, flow_memuse)
Definition: flow.h:260
FlowQueue flow_spare_q
Definition: flow-private.h:91